DNS
Resolvers can return different cached records depending on geography, TTL and propagation state.
Network & Web Tools
Pro diagnostic reportContent Security Policy (CSP) Analyzer Online Free
Parse a Content Security Policy, highlight unsafe source expressions and find missing core directives.
Diagnose
Run a bounded public check.
Understand
See a health score and explanation.
Act
Follow prioritized recommendations.
Analyze a Content Security Policy
Paste the value of a Content-Security-Policy header. The policy stays in your browser.
Security grade
B
Score
82/100
Directives
8
default-src
'self'
script-src
'self'https://cdn.example.com
style-src
'self''unsafe-inline'
img-src
'self'data:
object-src
'none'
base-uri
'self'
frame-ancestors
'none'
upgrade-insecure-requests
Boolean directiveRisk findings
- • style-src allows 'unsafe-inline'. Prefer nonces or hashes.
Missing recommended directives
All core directives are present.
About this tool
Content Security Policy helps reduce cross-site scripting and unwanted resource loading. This analyzer converts a raw policy into readable directives and surfaces common weaknesses such as unsafe-inline, unsafe-eval, wildcards and insecure HTTP sources.
Common use cases
- ✓ Review a CSP before production deployment.
- ✓ Audit policies generated by frameworks or CDNs.
- ✓ Find missing default, script, object and framing restrictions.
- ✓ Compare policy changes during security hardening.
How to use it
- Paste the CSP header value without the header name.
- Review parsed directives and source expressions.
- Check risk findings and missing recommendations.
- Update the policy carefully and test in Report-Only mode first.
Important interpretation notes
- • Roll out strict policies gradually to avoid breaking legitimate resources.
- • Nonces and hashes must be generated and applied correctly by the application.
- • This tool provides heuristic guidance and is not a penetration test.
Professional interpretation guide
Understand and verify your content security policy (csp) analyzer results
Use the result as a focused diagnostic signal. Verify important findings before changing DNS, hosting, security, caching or application configuration.
What the result tells you
- ✓ Directives define which sources may provide scripts, styles, images, frames and other resources.
- ✓ Fallback behaviour means some resource types inherit from broader directives.
- ✓ Warnings identify risky or missing controls that require application-specific review.
How to verify it
- Deploy in report-only mode first where practical.
- Review browser console violations across representative pages.
- Use nonces or hashes carefully for required inline code.
Network diagnostics
Interpret results in the correct protocol layer
Network tools observe different layers: DNS resolves names, TCP establishes connections, TLS authenticates encrypted sessions and HTTP carries requests, redirects, headers and caching rules. A successful result at one layer does not prove that the complete website or application is healthy.
TLS
Certificate validity, hostname matching, trust chains and protocol support are separate checks.
HTTP
Status codes, redirect chains, headers and caching directives describe application behaviour.
Measurement context
Latency and reachability vary by location, network path, browser and time.
What the operation can change
- A cached DNS answer may differ from an authoritative nameserver response.
- A 200 status code can still return the wrong content or an application error page.
- A valid certificate does not prove the website itself is trustworthy.
- Security-header tools report configuration, not complete vulnerability coverage.
Domain-specific verification
- Repeat tests from another network or resolver when location matters.
- Check the final URL and every redirect hop.
- Confirm timestamps, certificate names and expiry dates.
- Use browser developer tools and server logs for production incidents.
Common mistakes to avoid
- • Copying a strict policy without testing application dependencies.
- • Allowing broad wildcards that weaken protection.
- • Assuming CSP replaces output encoding and other security controls.
Privacy and safe use
Policy text is analyzed locally. Remove private hostnames or reporting endpoints before sharing results publicly.
Limitations
- • A strong CSP does not fix every web vulnerability.
- • Correctness depends on actual page resources and browser support.
Continue the diagnostic workflow
Combine related checks instead of relying on one isolated result.
Related Network & Web Tools
Frequently asked questions
What is Content Security Policy?
CSP is an HTTP response header that limits where a page may load scripts, styles, images, frames and other resources from.
Why is unsafe-inline risky?
It permits inline code or styles and can weaken CSP protection. Nonces or hashes are usually safer for scripts.
Does a high grade guarantee security?
No. CSP is one security layer and the actual application, endpoints, dependencies and browser behaviour still need review.
Can I test a Report-Only policy?
Yes. Paste the policy value itself; the parser treats it the same way for structural analysis.